CVE-2012-10059 — Dolibarr ERP/CRM Post-Auth OS Command Injection
Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sa…
Published: 2025-08-13 · CVSS: 9.4 · CVSS 4.0
Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7